fix: contain lone-surrogate serialization failures in transport writers

[naveecode]

Fixes #3707

Motivation and Context

A Python str with a lone surrogate (e.g. from os.fsdecode() on a non-UTF-8 path) passes validation and model_dump(mode="json"), then fails only in model_dump_json() inside the transport writer. That exception was uncaught in stdio stdout_writer / stdin_writer (and could break SSE / streamable HTTP framing), so one bad message tore down the session.

Escaping as \udcff (JS JSON.stringify) is not a good wire fix here: pydantic’s JSON parser rejects lone-surrogate escapes on the receiving side. Containing the failure matches how other bad serializations already become Internal server error higher in the stack.

Approach

• New mcp.shared.wire.serialize_outbound_message: try model_dump_json; on failure, substitute Internal server error for responses/errors with an id, otherwise return None.
• Stdio server writer: skip/Internal error and keep looping.
• Stdio client writer: for a failed request, inject a local JSON-RPC error on the read stream so that call fails without closing the session; later writes continue.
• SSE and streamable HTTP event/JSON paths: same helper so one bad frame does not kill the stream.

How Has This Been Tested?

• tests/shared/test_wire.py — helper behavior (response → Internal error, request/notification → None, healthy path unchanged).
• tests/server/test_stdio.py::test_stdio_server_surrogate_in_response_does_not_kill_writer
• tests/client/test_stdio.py::test_surrogate_in_outbound_request_does_not_tear_down_writer
• Also green: full tests/server/test_stdio.py, tests/client/test_stdio.py, tests/server/test_sse_security.py, tests/client/test_streamable_http.py; pyright + ruff on touched files.

Breaking Changes

None. Sessions that previously died on a surrogate now keep serving; the bad message becomes an error / drop for that request only.

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation update

Checklist

• I am assigned to the linked issue (or it is labeled help wanted, or I'm a maintainer)
• I have disclosed any AI assistance and can explain the change in my own words
• I have read the MCP Documentation
• My code follows the repository's style guidelines
• New and existing tests pass locally
• I have added appropriate error handling
• I have added or updated documentation as needed

Additional context

Per CONTRIBUTING, outside PRs need assignment or help wanted — happy to adjust if maintainers prefer a different containment shape. Approach is described on the issue.

AI-assisted drafting; I verified the repro, that \udcff escaping is rejected by pydantic’s parser, and the regression tests.

[github-actions]

This PR has been closed automatically. This repo only keeps pull requests open when they come from a maintainer, or from a contributor a maintainer has assigned to the linked issue, and you aren't currently assigned to #3707.

If a maintainer assigns you to #3707, this PR reopens on its own and there's nothing more you need to do here. Assignment is a maintainer call based on capacity; comments that only ask to be assigned don't factor in. What does help is engaging on the issue itself by confirming the repro, explaining why it matters for your use case, or describing the approach you'd take.

You're welcome to keep pushing commits here (just avoid force-pushing, since GitHub can't reopen a rewritten branch), but that on its own won't get the PR reviewed or the issue assigned, and realistically most auto-closed PRs stay closed. There's no need to open a new PR either way.

CONTRIBUTING.md has the full reasoning, but in short:

• We're a small team with very little capacity to review community PRs right now.
• Many recent PRs are AI-generated with little human review, and reviewing one carefully still costs a maintainer as much time as it ever did. A well-described issue is usually more useful to us than the code.

Maintainers: reopen, remove missing-issue-link, or add bypass-issue-check to override.